Hexmen Analisi

IOB - Indicator of Behavior (1000)

Sequenza temporale

Linguaggio

en996
zh4

Nazione

us998
cn2

Attori

Attività

Interesse

Sequenza temporale

Genere

Fornitore

Prodotto

SourceCodester E-Commerce System4
TRENDnet TEW-652BRP4
Apple tvOS4
TRENDnet TEW-811DRU2
Oracle Database Server2

Vulnerabilità

#VulnerabilitàBaseTemp0dayOggiSfrConEPSSCTICVE
1TRENDnet TEW-652BRP Web Interface ping.ccp escalazione di privilegi8.17.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.010490.05CVE-2023-0640
2TRENDNet TEW-811DRU httpd guestnetwork.asp buffer overflow7.57.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000600.05CVE-2023-0617
3Netgear WNDR3700v2 Web Interface denial of service4.34.2$5k-$25k$0-$5kProof-of-ConceptNot Defined0.001350.02CVE-2023-0850
4TRENDnet TEW-811DRU httpd security.asp buffer overflow7.57.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.001370.07CVE-2023-0613
5TRENDnet TEW-652BRP Web Service cfg_op.ccp buffer overflow7.56.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.000970.02CVE-2023-0618
6TRENDnet TEW-652BRP Web Management Interface get_set.ccp escalazione di privilegi8.88.6$0-$5k$0-$5kProof-of-ConceptNot Defined0.000760.04CVE-2023-0611
7TP-Link Archer C50 Web Management Interface denial of service6.56.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000740.02CVE-2023-0936
8TRENDnet TEW-811DRU Web Management Interface wan.asp buffer overflow6.56.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.001330.03CVE-2023-0637
9SourceCodester Alphaware Simple E-Commerce System sql injection7.06.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.001520.07CVE-2023-1504
10Ubiquiti EdgeRouter X OSPF escalazione di privilegi [Contestazione]8.17.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.009340.05CVE-2023-1458
11SourceCodester Alphaware Simple E-Commerce System admin_index.php sql injection7.06.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.001520.03CVE-2023-1503
12SourceCodester E-Commerce System setDiscount.php sql injection6.66.5$0-$5k$0-$5kProof-of-ConceptNot Defined0.001520.02CVE-2023-1505
13SourceCodester Alphaware Simple E-Commerce System edit_customer.php sql injection7.06.8$0-$5k$0-$5kProof-of-ConceptNot Defined0.001520.04CVE-2023-1502
14SourceCodester E-Commerce System cross site scripting4.14.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.000520.06CVE-2023-1569
15Apache HTTP Server mod_reqtimeout denial of service5.35.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.016960.00CVE-2007-6750
16Apple tvOS WebKit buffer overflow7.57.4$0-$5k$0-$5kNot DefinedOfficial Fix0.014160.00CVE-2019-8673
17Apple tvOS WebKit buffer overflow7.57.4$0-$5k$0-$5kNot DefinedOfficial Fix0.960680.02CVE-2019-8672
18Oracle Database Server Core RDBMS Privilege Escalation7.57.5$5k-$25k$5k-$25kNot DefinedNot Defined0.001130.02CVE-2011-2253

IOC - Indicator of Compromise (32)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDindirizzo IPHostnameAttoreCampagneIdentifiedGenereFiducia
158.218.200.2Hexmen13/02/2022verifiedAlto
2103.42.180.113Hexmen13/02/2022verifiedAlto
3103.230.108.85Hexmen13/02/2022verifiedAlto
4114.115.209.191ecs-114-115-209-191.compute.hwclouds-dns.comHexmen13/02/2022verifiedAlto
5119.28.133.78Hexmen13/02/2022verifiedAlto
6119.249.54.119Hexmen13/02/2022verifiedAlto
7121.18.238.80hebei.18.121.in-addr.arpaHexmen13/02/2022verifiedAlto
8XXX.XXX.XX.XXXxxx-xxx-xxx-xx-xxx.xxxxxxx.xxxxxxxx-xxx.xxxXxxxxx13/02/2022verifiedAlto
9XXX.XXX.XX.XXXxxx-xxx-xxx-xx-xxx.xxxxxxx.xxxxxxxx-xxx.xxxXxxxxx13/02/2022verifiedAlto
10XXX.XXX.XX.XXXxxx-xxx-xxx-xx-xxx.xxxxxxx.xxxxxxxx-xxx.xxxXxxxxx13/02/2022verifiedAlto
11XXX.XXX.XX.XXXxxx-xxx-xxx-xx-xxx.xxxxxxx.xxxxxxxx-xxx.xxxXxxxxx13/02/2022verifiedAlto
12XXX.XXX.XX.XXxxx-xxx-xxx-xx-xx.xxxxxxx.xxxxxxxx-xxx.xxxXxxxxx13/02/2022verifiedAlto
13XXX.XXX.XX.XXxxx-xxx-xxx-xx-xx.xxxxxxx.xxxxxxxx-xxx.xxxXxxxxx13/02/2022verifiedAlto
14XXX.XX.XX.XXXXxxxxx13/02/2022verifiedAlto
15XXX.XXX.XXX.XXXxxxxx13/02/2022verifiedAlto
16XXX.XX.XXX.XXXXxxxxx13/02/2022verifiedAlto
17XXX.XX.XXX.XXXxxxxx13/02/2022verifiedAlto
18XXX.XX.XX.XXXXxxxxx13/02/2022verifiedAlto
19XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
20XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
21XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
22XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
23XXX.XXX.X.XXXxxxxx13/02/2022verifiedAlto
24XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
25XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
26XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
27XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
28XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
29XXX.XXX.XX.XXXXxxxxx13/02/2022verifiedAlto
30XXX.XXX.XXX.XXXxxxxx13/02/2022verifiedAlto
31XXX.XXX.XXX.XXXxxxxx13/02/2022verifiedAlto
32XXX.XXX.XXX.XXXXxxxxx13/02/2022verifiedAlto

TTP - Tactics, Techniques, Procedures (3)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitàAccesso al vettoreGenereFiducia
1T1059.007CWE-79Cross Site ScriptingpredictiveAlto
2TXXXXCWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveAlto
3TXXXXCWE-XXXxx XxxxxxxxxpredictiveAlto

IOA - Indicator of Attack (22)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClasseIndicatorGenereFiducia
1File/ecommerce/admin/settings/setDiscount.phppredictiveAlto
2File/wireless/guestnetwork.asppredictiveAlto
3File/wireless/security.asppredictiveAlto
4Filexxxxx/xxxxx_xxxxx.xxxpredictiveAlto
5Filexxxxx/xxxx/xxxxxxxxxx.xxx?xxxxxx=xxxxpredictiveAlto
6Filexxx_xx.xxxpredictiveMedia
7Filexxxxxxxx/xxxx_xxxxxxxx.xxxpredictiveAlto
8Filexxx_xxx.xxxpredictiveMedia
9Filexxxx.xxxpredictiveMedia
10Filexxx.xxxpredictiveBasso
11ArgumentxxxxpredictiveBasso
12Argumentxxxxxx_xxx_xxpredictiveAlto
13Argumentxxxxx/xxxxxxxxpredictiveAlto
14Argumentxxxxxxxxx/xx/xxxxxxxxpredictiveAlto
15ArgumentxxpredictiveBasso
16Argumentxxxxxxxx/xxxxxxxxpredictiveAlto
17Argumentx_xxxxpredictiveBasso
18Input Valuexxxxxx xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)predictiveAlto
19Input Value<xxxxxx>xxxxx('x')</xxxxxx>predictiveAlto
20Input Valuex' xxxxx xxxxx(x) xxx 'xxxx'='xxxxpredictiveAlto
21Input Valuexxxxx' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxxpredictiveAlto
22Input Valuexxxxx%xxxxxx.xxx ' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx) xxx 'xxxx'='xxxxpredictiveAlto

Referenze (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!